decrypt_netwire.py

# python script to decrypt new variant of NetWire keylog files.
# author: lopqto https://lopqto.me
# blog post: https://lopqto.me/posts/netwire-decrypting-keylog-file

import sys

if len(sys.argv) > 1:
	filename = sys.argv[1]
else:
	print('please pass the filename as argv')
	exit(-1)

decrypted = ""

with open(filename, "rb") as f:
	buffer = f.read(1)
	while buffer:
		res = (ord(buffer) - 36) ^ 0x9D
		try:
			decrypted = decrypted + chr(res)
		except:
			pass
		
		buffer = f.read(1)

print(decrypted)